Alert Setup

sayashagarwal27 · ‎02-05-2021

Alert should trigger each time if count of event is less 10 in last 30 min. But it will aggregate alerts if count is more than 10 in last 30 min

richgalloway · ‎02-05-2021

So if two events occur every 30 minutes then you want two alerts triggered and if 11 events occur then you want a single alert, correct? If so then Splunk does not throttle alerts that way. Go to https://ideas.splunk.com to suggest Splunk offer it.

If that is not what you seek then please describe the problem more.

---
If this reply helps you, Karma would be appreciated.

Alert Setup

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Alert Setup

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...